Skip to content

Fix incident authorization and swap request signing - #1282

Merged
fejilaup-cloud merged 5 commits into
AtomicIP:mainfrom
Sundriveauto:fix/incident-and-swap-request-auth
Oct 21, 2026
Merged

fejilaup-cloud merged 5 commits into
AtomicIP:mainfrom
Sundriveauto:fix/incident-and-swap-request-auth

Conversation

@Sundriveauto

@Sundriveauto Sundriveauto commented Oct 17, 2026 •

Copy link
Copy Markdown
Contributor

Closes #1195
Closes #1196
Closes #1197
Closes #1198

Summary

  • Bind postmortem authors to the authenticated JWT subject, require incident-administration access, and prevent replacement submissions.
  • Authenticate Alertmanager webhooks and validate status and alert identity fields before updating incidents.
  • Remove duplicate unsigned legacy swap routes and enforce request signatures.
  • Apply signature verification to all versioned swap write routes, with regression coverage.

Commits

This PR contains four focused commits, one per reported issue.

Validation

  • git diff --check passed.
  • Rust tests and formatting checks could not run because cargo is not installed in this environment.

Sundriveauto and others added 4 commits October 17, 2026 18:59
Require authenticated access to incident administration, derive postmortem authors from the JWT subject, and reject replacement submissions.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Require a configured bearer token, validate Alertmanager statuses and alert identity fields before applying updates, and document the shared-secret wiring.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove duplicate unsigned swap registrations and apply request-signature middleware to batch initiation and cancel-expired routes. Preserve signed commit/transfer routes while resolving router construction.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Apply request-signature verification to initiate, batch and bulk initiation, and cancel-expired on the v1 router. Add regression coverage for unsigned requests and complete the rate-limiter state in test routers.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@drips-wave

drips-wave Bot commented Oct 18, 2026

Copy link
Copy Markdown

@Sundriveauto Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@fejilaup-cloud
fejilaup-cloud merged commit 527ac6c into AtomicIP:main Oct 21, 2026
0 of 3 checks passed
gabrielujelistic-collab pushed a commit to Stellar-drive/stellar-drive-atomic-ip that referenced this pull request Nov 9, 2026
…wap-request-auth

Fix incident authorization and swap request signing
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants